Vulnerabilities (CVE)

Filtered by vendor Posimyth Subscribe
Total 12 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2023-45751 1 Posimyth 1 Nexter Extension 2024-01-04 N/A 7.2 HIGH
Improper Control of Generation of Code ('Code Injection') vulnerability in POSIMYTH Nexter Extension.This issue affects Nexter Extension: from n/a through 2.0.3.
CVE-2023-45750 1 Posimyth 1 Nexter Extension 2023-12-10 N/A 6.1 MEDIUM
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in POSIMYTH Nexter Extension plugin <= 2.0.3 versions.
CVE-2023-45657 1 Posimyth 1 Nexter 2023-12-10 N/A 9.8 CRITICAL
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in POSIMYTH Nexter allows SQL Injection.This issue affects Nexter: from n/a through 2.0.3.
CVE-2021-4332 1 Posimyth 1 The Plus Addons For Elementor 2023-12-10 N/A 6.5 MEDIUM
The Plus Addons for Elementor plugin for WordPress is vulnerable to arbitrary file reads in versions up to, and including 4.1.9 (pro) and 2.0.6 (free). The plugin has a feature to add an "Info Box" to an Elementor created page. This Info Box can include an SVG image for the box. Unfortunately, the plugin used file_get_contents with no verification that the file being supplied was an SVG file, so any user with access to the Elementor page builder, such as contributors, could read arbitrary files on the WordPress installation.
CVE-2021-4331 1 Posimyth 1 The Plus Addons For Elementor 2023-12-10 N/A 8.8 HIGH
The Plus Addons for Elementor plugin for WordPress is vulnerable to privilege escalation in versions up to, and including 4.1.9 (pro) and 2.0.6 (free). The plugin adds a registration form to the Elementor page builders functionality. As part of the registration form, users can choose which role to set as the default for users upon registration. This field is not hidden for lower-level users so any user with access to the Elementor page builder, such as contributors, can set the default role to administrator. Since contributors can not publish posts, only author+ users can elevate privileges without interaction via a site administrator (to approve a post).
CVE-2021-24949 1 Posimyth 1 The Plus Addons For Elementor 2023-12-10 7.5 HIGH 9.8 CRITICAL
The "WP Search Filters" widget of The Plus Addons for Elementor - Pro WordPress plugin before 5.0.7 does not sanitise and escape the option parameter before using it in a SQL statement, which could lead to SQL injection
CVE-2021-24948 1 Posimyth 1 The Plus Addons For Elementor 2023-12-10 5.0 MEDIUM 7.5 HIGH
The Plus Addons for Elementor - Pro WordPress plugin before 5.0.7 does not validate the qvquery parameter of the tp_get_dl_post_info_ajax AJAX action, which could allow unauthenticated users to retrieve sensitive information, such as private and draft posts
CVE-2021-24175 1 Posimyth 1 The Plus Addons For Elementor 2023-12-10 7.5 HIGH 9.8 CRITICAL
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.7 was being actively exploited to by malicious actors to bypass authentication, allowing unauthenticated users to log in as any user (including admin) by just providing the related username, as well as create accounts with arbitrary roles, such as admin. These issues can be exploited even if registration is disabled, and the Login widget is not active.
CVE-2021-24359 1 Posimyth 1 The Plus Addons For Elementor 2023-12-10 5.0 MEDIUM 5.3 MEDIUM
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.11 did not properly check that a user requesting a password reset was the legitimate user, allowing an attacker to send an arbitrary reset password email to a registered user on behalf of the WordPress site. Such issue could be chained with an open redirect (CVE-2021-24358) in version below 4.1.10, to include a crafted password reset link in the email, which would lead to an account takeover.
CVE-2021-24351 1 Posimyth 1 The Plus Addons For Elementor 2023-12-10 4.3 MEDIUM 6.1 MEDIUM
The theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.12 did not properly sanitise some of its fields, leading to a reflected Cross-Site Scripting (exploitable on both unauthenticated and authenticated users)
CVE-2021-24266 1 Posimyth 1 The Plus Addons For Elementor Page Builder Lite 2023-12-10 3.5 LOW 5.4 MEDIUM
The “The Plus Addons for Elementor Page Builder Lite” WordPress Plugin before 2.0.6 has four widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
CVE-2021-24358 1 Posimyth 1 The Plus Addons For Elementor 2023-12-10 5.8 MEDIUM 6.1 MEDIUM
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.10 did not validate a redirect parameter on a specifically crafted URL before redirecting the user to it, leading to an Open Redirect issue.